David J. Kappos
Partner
Cravath, Swaine & Moore
New York, NY
Vincent Joralemon
Director
Berkeley Law Life Sciences Law & Policy Center
Berkeley, CASmart cities are no longer a futuristic concept—they are a present-day reality. From Barcelona’s energy-efficient lighting to Singapore’s adaptive traffic systems, urban centers worldwide are integrating technology to enhance efficiency, sustainability and public services. They are providing early signs that connecting urban systems (e.g., transportation, utilities, public safety, etc.) yields a synergy in which the whole is greater than the sum of its parts.
However, these advancements bring complex legal and governance challenges that require careful navigation. As a cautionary tale, one need only look to Toronto’s Quayside project.¹ Started in 2017, the Quayside project aimed to create a technologically advanced neighborhood. Despite its ambitious vision and ample funding, the city abandoned the project in less than three years due to public backlash over privacy concerns and data governance. The lesson: even the most innovative, well-resourced initiatives can fail without transparency, accountability and public trust—foundational pillars of any sustainable smart city governance framework.
Regulators are responding. Laws like the EU’s General Data Protection Regulation (GDPR), Singapore’s Personal Data Protection Act (PDPA), and California’s Consumer Privacy Act (CCPA) require that cities obtain user consent for data collection, limit how data is processed and shared, and conduct Data Protection Impact Assessments (DPIAs). These requirements introduce real friction into smart city models, which often depend on continuous and ambient data collection. The legal challenge is to reconcile innovation with privacy-by-design principles, ethical risk assessments and compliance across multiple jurisdictions.
Finally, there is the issue of IP ownership and control. Smart city initiatives frequently involve a mix of public agencies and private vendors. That raises fundamental legal questions: Who owns the underlying data? Who controls the algorithms and the software driving core infrastructure? Without clear contractual terms, cities risk vendor lock in—becoming dependent on a single vendor for products or services and losing the freedom to switch to another vendor without incurring substantial cost and disruption. In response, we’re seeing new licensing strategies and a growing emphasis on open standards and public-private IP sharing models to help cities maintain meaningful control over their digital infrastructure.
Taken together, these challenges suggest a broader truth: smart cities are not just technology projects—they are legal and governance projects as well. In this article, we will explore each of these themes—from privacy to interoperability, blockchain to AI—and offer a legal framework for guiding smart city innovation. The foundational tensions—between innovation and governance, public interest and private control—carry through every layer of smart city development. When legal frameworks evolve alongside technological innovation, smart cities can realize compounding benefits—where connected systems enhance each other’s performance in ways no single solution could achieve alone, while also creating clearer, more cohesive pathways for effective regulation.
Data is the fuel of smart cities—from traffic sensors to utility grids, every system generates and relies on real-time information. And much of the data includes some amount of personal information— names, addresses, identification numbers, etc. While the implementing technology solutions promote integration and optimization, legal frameworks often thwart or even prevent it. Regulations like the EU’s GDPR, Singapore’s PDPA, and California’s CCPA impose tight restrictions on how personal data can be processed and shared—particularly across borders.
For example, the Schrems II decision by the Court of Justice of the European Union invalidated the Privacy Shield framework and raised significant uncertainty about EU-U.S. data transfers.² Now, cities working with international vendors or cloud providers must navigate multiple overlapping legal regimes, each with distinct definitions of personal data, consent requirements and transfer mechanisms. To stay compliant, cities routinely conduct privacy impact assessments and adopt technical and legal safeguards—such as pseudonymization, data minimization or Standard Contractual Clauses (SCCs). These SCCs are under regular scrutiny and revision by regulators, meaning cities must continuously monitor updates to ensure ongoing compliance.
Beyond cross-border data restrictions, a second major friction point is interoperability. Cities rely on a matrix of sensors, software and platforms—often from different vendors. Without common standards or open APIs, data becomes siloed. Initiatives like Open & Agile Smart Cities (OASC)³ promote interoperability by defining Minimal Interoperability Mechanisms (MIMs) that allow systems to communicate regardless of vendor. At the same time, interoperability raises important legal questions—most notably, who owns or has rights to the software interfaces and the underlying data schemas? Licensing models must ensure that open APIs and shared standards do not inadvertently expose proprietary technology or restrict downstream reuse. Efforts to standardize communications across platforms—such as the adoption of ISO/IEC 3041⁴ and oneM2M⁵ protocols— represent important progress toward technological harmonization. Yet without corresponding legal clarity around access, ownership and licensing, these initiatives risk falling short of their full potential.
As cities strive to integrate diverse technologies, clarity over data ownership and licensing becomes essential to ensure systems can work and grow together. City-collected data may be subject to IP protections—like copyright, confidentiality restrictions or sui generis database rights—especially when private contractors are involved. Licensing frameworks are evolving to strike a balance: enabling cities to reuse or share data for the public good while preserving proprietary rights for vendors. Legal agreements must clearly define the scope of permitted use, whether data is subject to open licenses (e.g., Creative Commons),⁶ and how derivative works are treated. Absent these terms, cities risk either overstepping IP boundaries or losing access to data they helped generate. This is especially important for emerging models like data trusts and public data commons, where multiple stakeholders contribute and govern shared urban datasets. Clear terms governing access, modification, attribution and redistribution are essential to support these collaborative data ecosystems. As cities generate and integrate data broadly, the legal considerations described above—privacy, interoperability and ownership—form the foundation on which smarter, more trusted infrastructure must be built.
Smart cities thrive on seamless data flows—but these raise serious legal and technical challenges around privacy, IP and control. Distributed ledger technologies offer one possible solution: decentralized tools for managing identity, payments and trust across systems. Distributed ledger technology—particularly blockchain—is emerging as a foundational infrastructure layer for smart cities.
One high-impact use case is digital identity. Instead of relying on centralized ID databases vulnerable to breaches, blockchain enables decentralized credentials that are owned and managed by individuals and verified through cryptographic proofs. A citizen could, for example, prove residency without disclosing additional personal data. But this architecture introduces legal complexity. Blockchains are by design immutable, while privacy laws (e.g., GDPR) require mechanisms to delete or correct personal data. To address this, smart identity systems typically store sensitive data off-chain and record only hashed or tokenized references on-chain, enabling compliance without compromising data integrity. Zug, Switzerland, for example, has implemented uPort, a blockchain based identity platform on the Ethereum network, allowing residents to access e-government services and vote securely.⁷ More advanced approaches use tools like zero-knowledge proofs (ZKPs), which allow individuals to prove that a specific claim (such as a document’s authenticity) is true without revealing any unnecessary personal information. Buenos Aires, for instance, has integrated ZKPs into its miBA platform, enabling citizens to verify credentials such as residency or age without revealing other personal information.⁸
Blockchain also supports novel payment and incentive models. Some cities are experimenting with token-based systems for public transit, recycling rewards or local sustainability programs. For example, residents might earn digital tokens for reducing energy consumption, which can then be redeemed for municipal credits or services. These systems promote community engagement and resource efficiency, but raise compliance challenges. Legally, cities must determine whether such tokens constitute regulated financial instruments—and structure agreements with vendors to address licensing, custody, tax treatment and usage restrictions. Depending on how they are structured, tokens may implicate securities regulations or trigger obligations under know-your-customer, anti-money
laundering, consumer protection and tax laws. Cities often turn to financial sandbox programs or pursue tailored regulatory exemptions to responsibly deploy
token-based tools.
These token systems, and many other smart city applications, are increasingly governed by smart contracts—self-executing code on a blockchain that performs functions automatically when predefined conditions are met. For instance, a contract could trigger payment once a sensor confirms that a public service, like waste collection, has been completed. These tools can streamline workflows and reduce administrative overhead, but also raise legal issues: Are smart contracts enforceable? Who bears liability if the code contains an error?
Some U.S. jurisdictions, including Arizona and Tennessee, have passed laws recognizing smart contracts as legally valid under electronic records statutes. However, broader legal consensus is still developing. To mitigate risk, cities typically require code audits before deployment, human override capabilities and clear documentation outlining the contract’s terms and intent.
In addition to automation, blockchain offers an important governance benefit: tamper-proof audit trails. These immutable records can log events such as access to surveillance footage or modifications to infrastructure systems—providing cities with legally reliable records that support public records retention obligations, regulatory audits and accountability mandates.
Yet even as blockchain promises auditability and transparency, many smart city systems are now turning to AI for real-time analysis, prediction and decision-making. These tools offer enormous efficiencies—but also raise critical legal questions about accountability, fairness and intellectual property.
Artificial intelligence is increasingly the cognitive engine behind smart city operations—optimizing traffic flows, predicting energy demand and even automating public permitting. But as AI systems take on more civic functions, legal and ethical risks intensify.
Algorithmic bias is a major concern. Tools like facial recognition and predictive policing have been shown to disproportionately impact marginalized populations. The EU’s new AI Act addresses this by classifying many public sector AI systems as “high risk.” These systems will require built-in safeguards: transparency, risk assessments, human oversight and accountability mechanisms. Public agencies must be able to explain algorithmic decisions and provide individuals with the ability to contest or override them.
However, transparency requirements create legal tension. Public agencies are increasingly expected to explain decisions made using AI—but many vendors claim the models they use are trade secrets. This conflict between explainability and intellectual property protection is a growing friction point in public procurement and algorithmic accountability. Legal frameworks are still evolving to balance these interests, with some jurisdictions requiring disclosure of key decision logic while protecting proprietary aspects of the model. But the tension plays out in procurement contracts and public disclosure obligations: cities must negotiate terms that allow for meaningful auditability without violating vendor IP protections. Licensing agreements are evolving to include tailored disclosure rights, audit clauses or escrowed algorithms to strike this balance.
An early example of civic AI innovation is Boston’s “Street Bump” initiative.⁹ The city launched a mobile app that used smartphone accelerometers to detect potholes as residents drove, automatically transmitting this data to public works departments to improve road maintenance. While the project aimed to improve service delivery through citizen input, it also revealed key smart city risks. The data disproportionately reflected activity in neighborhoods where residents had smartphones and downloaded the app—creating blind spots in lower-income or less-connected communities. This illustrates a critical point: even well-intentioned innovation can exacerbate structural inequities if not carefully designed and managed. Legal frameworks for smart city AI must incorporate not only privacy and transparency requirements, but also equity by-design principles to ensure that benefits—and burdens—are distributed fairly.
AI also introduces legal complexity around ownership and intellectual property. Cities may use AI to generate reports, designs or predictive models— but who owns those outputs? In most jurisdictions, AI-generated content is not eligible for copyright or patent protection unless there is meaningful human authorship. For example, U.S. courts and the Copyright Office have held that AI-created works without human input are not protectable, and AI systems cannot be named inventors under patent law.
This makes contracts essential. Cities working with AI vendors need clear terms allocating rights in AI outputs, defining licensing requirements and setting limits on reuse. Moreover, the data used to train municipal AI systems may itself be protected by copyright, trade secret or database rights— making proper sourcing and licensing vital to avoid infringement.
Privacy is another core concern. AI systems often process large volumes of personal data, raising legal obligations under laws like the GDPR. Article 22 of the GDPR, for example, grants individuals the right not to be subject to decisions based solely on automated processing—such as AI systems operating without meaningful human involvement—that result in legal or similarly significant effects.¹⁰ A city using AI to issue parking tickets or determine eligibility for public benefits may need to ensure that meaningful human review is available and documented.
More broadly, privacy-by-design requires cities to limit the collection and use of personal data, adopt anonymization where feasible, and secure AI systems against re-identification (where anonymized individuals are re-identified by linking datasets), inference attacks (where adversaries deduce sensitive attributes from seemingly innocuous data) or data poisoning (where malicious data corrupts AI training sets). Ethical frameworks like Singapore’s Model AI Governance Framework offer practical principles— such as transparency, fairness and accountability— that cities can adopt to guide responsible deployment and maintain public trust.¹¹
A further risk is the vulnerability of AI models to cyber threats. Smart city AI systems are increasingly targeted by model poisoning (where training data is manipulated to degrade model performance) and adversarial attacks (where inputs are subtly altered to cause misclassification or system failure). These risks demand not only technical defenses—like robust validation, adversarial training and monitoring— but also legal safeguards around liability, response obligations and public disclosure in the event of system compromise.
The AI-related challenges discussed above reveal a broader truth: as cities rely more heavily on algorithmic systems, legal frameworks must evolve not just to manage risk, but to shape outcomes in the public interest. Meeting this moment requires governance models that incorporate accountability, equity and transparency into their design. With clear rules around ownership, oversight, privacy and resilience, cities can ensure that AI builds public trust and drives both efficiency and inclusion.
As cities evolve into smart urban ecosystems, legal frameworks must adapt to address the complex and overlapping challenges that accompany technological advancement. Effective data governance is essential to ensure that policies around collection, usage and sharing protect privacy and meet regulatory requirements. Interoperability is equally critical, requiring the adoption of open standards that allow diverse technologies and systems to integrate with one another. Public-private partnerships must be structured to balance innovation with the public interest, enabling cities to retain meaningful control over the infrastructure developed with private collaborators. Finally, the deployment of artificial intelligence must be guided by ethical safeguards that prevent bias, promote transparency and establish clear lines of accountability. By proactively confronting these legal dimensions, cities can unlock the full potential of smart technologies—enhancing urban living while safeguarding the rights and well being of their residents.
When built on sound legal foundations, smart cities do not just get smarter—they become more responsive, resilient and equitable. The opportunity is not merely to optimize infrastructure, but to reimagine urban life in ways that serve everyone.
Latest Articles Of The Month